RHSA-2026:58712: Important: freerdp security update
FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.Security Fix(es): FreeRDP: FreeRDP: Arbitrary code execution via malicious RDP files (CVE-2026-64624) FreeRDP: FreeRDP: Denial of Service via crafted WindowIcon async message (CVE-2026-67299) FreeRDP: FreeRDP: HTTP Proxy Request Injection via Redirection (CVE-2026-67289) FreeRDP: FreeRDP: Remote code execution or denial of service via audio input integer overflow (CVE-2026-68580) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/freerdpto a version that resolves this vulnerability.Fixed in 2.4.1-6.el9_2.11 - Upgrade
Upgrade
redhat/freerdp-debuginfoto a version that resolves this vulnerability.Fixed in 2.4.1-6.el9_2.11 - Upgrade
Upgrade
redhat/freerdp-debugsourceto a version that resolves this vulnerability.Fixed in 2.4.1-6.el9_2.11 - Upgrade
Upgrade
redhat/freerdp-libsto a version that resolves this vulnerability.Fixed in 2.4.1-6.el9_2.11 - Upgrade
Upgrade
redhat/freerdp-libs-debuginfoto a version that resolves this vulnerability.Fixed in 2.4.1-6.el9_2.11 - Upgrade
Upgrade
redhat/libwinprto a version that resolves this vulnerability.Fixed in 2.4.1-6.el9_2.11 - Upgrade
Upgrade
redhat/libwinpr-debuginfoto a version that resolves this vulnerability.Fixed in 2.4.1-6.el9_2.11 - Upgrade
Upgrade
redhat/freerdpto a version that resolves this vulnerability.Fixed in 2.4.1-6.el9_2.11.aa - Upgrade
Upgrade
redhat/freerdp-debuginfoto a version that resolves this vulnerability.Fixed in 2.4.1-6.el9_2.11.aa - Upgrade
Upgrade
redhat/freerdp-debugsourceto a version that resolves this vulnerability.Fixed in 2.4.1-6.el9_2.11.aa - Upgrade
Upgrade
redhat/freerdp-libsto a version that resolves this vulnerability.Fixed in 2.4.1-6.el9_2.11.aa - Upgrade
Upgrade
redhat/freerdp-libs-debuginfoto a version that resolves this vulnerability.Fixed in 2.4.1-6.el9_2.11.aa - Upgrade
Upgrade
redhat/libwinprto a version that resolves this vulnerability.Fixed in 2.4.1-6.el9_2.11.aa - Upgrade
Upgrade
redhat/libwinpr-debuginfoto a version that resolves this vulnerability.Fixed in 2.4.1-6.el9_2.11.aa - Upgrade
Upgrade
freerdpto a version that resolves this vulnerability.Patch https://access.redhat.com/articles/11258
Event History
Frequently Asked Questions
Which installed packages are in scope for this update?
The advisory lists redhat/freerdp, redhat/freerdp-libs, redhat/libwinpr, and their corresponding debuginfo and debugsource packages. Systems with these packages installed should be reviewed for the update.
What attacker-controlled inputs are associated with the reported issues?
The fixes address malicious RDP files, crafted WindowIcon asynchronous messages, redirection handling that can inject HTTP proxy requests, and an audio-input integer overflow. The audio-input flaw is described as allowing remote code execution or denial of service.
Does the advisory state whether a default configuration is vulnerable or provide temporary mitigations?
No. The provided advisory data does not describe default configuration exposure, fixed package versions, or mitigations for systems that cannot yet be patched.